Where to find your four ConnectWise fields.
Kyslan asks for a Company ID, a public key, a private key and the web address you sign in at. This page shows you exactly where each one comes from. It takes about a minute, and everything you create here is read-only and revocable in two clicks.
Why keys and not a login button? ConnectWise has no "sign in with ConnectWise" for outside tools. API keys are the only way it lets a product like Kyslan read your data, which is why every PSA integration asks for the same thing. The upside: a key you mint yourself is a key you can limit and revoke, and we cannot quietly widen it later.
The short version
If you already know your way around ConnectWise, this is the whole thing:
- System, Members, API Members tab. Make one with License Class API on a read-only security role. Do not use your own personal keys.
- On that member's API Keys tab, generate a key pair and copy both halves. The private one is shown once.
- Your Company ID is the company name you type at the ConnectWise login screen.
- Your ConnectWise address is the web address you sign in at, typed on its own: na.myconnectwise.net. Your own server works too.
- Paste all four into Kyslan, run the scan, then delete the API member.
Everything below is the same five steps, slower, with pictures.
Open the members list
In ConnectWise, go to System in the left navigation, then Members. You need admin rights to see it. If System is not in your menu, someone else at your company is the ConnectWise admin, and this is a two minute job to hand to them.
Diagram, not a screenshot. Your ConnectWise may be arranged a little differently by version.
Create an API member, not a person
On the Members screen there is a tab for API Members, separate from your staff. Open that tab and press the + in the toolbar to add one.
This matters more than it looks. An API member is a robot account that exists only to be read through. It sits on its own API licence class rather than taking a staff login, it cannot use the web interface, and deleting it later affects nobody. The alternative, generating keys under your own account, hands out a credential carrying your permissions, which for an admin means full write access to everything. Use the API member.
Diagram, not a screenshot. The toolbar icons vary between ConnectWise versions.
What to put in the fields
ConnectWise will ask for a handful of details. Nothing here is precious, and nothing here is visible to your clients:
| Field | What to enter |
|---|---|
| Member ID | kyslan, or anything you will recognise later |
| Member Name | Kyslan billing audit |
| Yours is fine. Nothing is sent to it. | |
| License Class | API. This is the field that keeps it off your staff licences, so do not skip it. |
| Role ID / Security Role | A read-only role. See making the role read-only below. |
| Level | Your top one, usually Corporate (Level 1), so the audit sees all your clients rather than one branch |
| Location, Business Unit | Your top level ones, for the same reason |
| Everything else | Leave the defaults |
Save it.
Generate the key pair
Reopen the API member you just saved, go to its API Keys tab and press + again. Give it a description so future you knows what it was for, something like Kyslan audit, then save.
ConnectWise now shows you two long strings. The public key and the private key. These are fields two and three on our form.
Diagram, not a screenshot. Real keys are longer than the examples shown.
Copy the private key before you close this screen. ConnectWise shows a private key once and will not show it to you again. If you lose it, no harm done, just delete the key and generate another one.
Your Company ID
This one trips people up because it sounds like a number. It is not. Your Company ID is the short company name you type into the ConnectWise login screen, above your username and password. Usually your business name with no spaces.
If nobody remembers it because the browser has been filling it in for years, log out and look at the login screen, or check the top of any ConnectWise email notification.
Diagram, not a screenshot.
Your ConnectWise address
The last field is just the web address you sign in to ConnectWise at. Type the address on its own, with no https:// in front and nothing after the first slash. We work out the rest from there.
| If you sign in at | Type this |
|---|---|
| https://na.myconnectwise.net/v4_6_release/… | na.myconnectwise.net |
| https://eu.myconnectwise.net/v4_6_release/… | eu.myconnectwise.net |
| https://connectwise.yourcompany.com/… | connectwise.yourcompany.com |
Diagram, not a screenshot.
Running ConnectWise on your own server, or through a partner who hosts it? That works here. Type the address you sign in at, exactly like anyone else, and we find the right place to call from it. The one thing we cannot reach is an address that only exists inside your own network, because our scanner runs on the internet. If that is you, the CSV route gets you the same report.
Making the role genuinely read-only
Kyslan never writes to your PSA. Our connector can only issue read requests, and that is enforced in our code, not just promised in our marketing. But you should not have to take our word for it, and the security role on your API member is how you hold us to it.
Security roles live under System, then Security Roles. Each area can be set to Add, Edit, Delete or Inquire. Inquire means look but do not touch, and it is the only one you need to give us. Set the role you attached in step 2 to Inquire on the modules below, leave everything else off, and Kyslan physically cannot change anything whatever our code does.
| ConnectWise module | Set to | Why the audit needs it |
|---|---|---|
| Companies | Inquire | To know who your clients are |
| Finance | Inquire | Agreements and their additions, which is where unbilled seats show up, plus invoices so we can see what actually got billed and report only the gap |
| Service Desk | Inquire | The tickets, meaning the work that was done |
| Time & Expense | Inquire | The hours logged against that work |
| System | Inquire | Documents attached to agreements, so we can read the signed contract itself where there is one |
If your ConnectWise already has a read-only or reporting role, reuse it. If not, copy an existing role, name it something like Read Only API, and drop everything to Inquire.
A narrower role means a smaller report, not a failed one. If we cannot see invoices, we say so in the report rather than guessing.
Paste them into Kyslan
Back on the audit form, pick ConnectWise Manage and fill in the four fields. You do not need anything else. The developer credential ConnectWise requires of integration vendors is ours, already registered, so there is nothing further for you to create.
Your keys are encrypted the second they reach us, used only for that one scan, and deleted when it finishes. The detail is on our security page.
Turning it off afterwards
When your report lands, you can shut the door immediately and it costs you nothing:
- Delete the API key from the member's API Keys tab, or
- Delete the whole API member from System, then Members, then API Members.
Either kills our access instantly and needs nothing from us. If you later want a repeat scan, you make a fresh key. We would rather ask twice than hold a key we are not using.
If something goes wrong
"ConnectWise rejected those API keys"
Nine times out of ten this is the Company ID rather than the keys. It is the login company name, not your company's record number and not your domain. Failing that, check the private key was pasted whole, with no stray space at either end.
"We found no company records"
The keys worked, so the role is the problem. The security role on the API member cannot read Companies. Set that area to Inquire and run it again.
"That doesn't look like a ConnectWise address"
Give us the bare address and nothing else. Drop the https:// and everything from the first slash onwards, so na.myconnectwise.net rather than the long link in your browser bar. An address that only resolves inside your own network will not work either, since our scanner reaches you over the internet.
It worked in ConnectWise but fails here
A brand new key can take a minute or two to become active across ConnectWise. Make a coffee and try once more before assuming anything is broken.
There is no API Members tab
Your ConnectWise login does not have admin rights. Whoever administers ConnectWise for you can do all of this in about two minutes, and you can send them this page.
Still stuck
Email hello@kyslan.com. It reaches the founder, not a queue. If it is easier, we will get on a call and do it with you. There is also always the CSV route, which asks for no keys at all and produces exactly the same report.